EntraCP: issue with Certificate

[senn00]

Hello,

I did move to EntraCP on our On Prom's 2019 SP instance. The implementation was OK on TEST env but I am facing the below issue on Prod.

When I try to configure EntraCP using Certificate (secret key no more allowed in our org), I have a red error:

Invalid certificate. Error message: Bad Data.

When I try to configure EntraCP with PowerShell, I have the following error:

PS E:\setup\EntraCP> $tenant.ClientCertificateWithPrivateKey = $cert
'ClientCertificateWithPrivateKey' is a ReadOnly property.
At line:1 char:1

• $tenant.ClientCertificateWithPrivateKey = $cert

•   + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : PropertyAssignmentException
  
  

Any idea what is the issue ?

Thank you very much in advance

[Yvand]

@senn00 can you use the script in this page to set the certificate using PowerShell?

[senn00]

Hi Yvan

Actually, I did try both option (GUI and PS script) and I got the errors for both options (Bad Data with GUI & ClientCertificateWithPrivateKey is a ReadOnly property with PS script).

I was doing all that from a WFE node and I've just tried from the App node (CA) and it seems to work.

Still I need to check if this is related to the node or to a patch I've deployed (could be related to the faced issue : KB5025823 Change in how .NET applications import X.509 certificates / https://support.microsoft.com/en-us/topic/kb5025823-change-in-how-net-applications-import-x-509-certificates-bf81c936-af2b-446e-9f7a-016f4713b46b)

please have a look at the link and let me know if EntraCP (configured with Certif) could be impacted by the described issue detailed on KB5025823

Best Regards

[Yvand]

Yes, this kb impacts EntraCP while importing a passwordless pfx certificate, and it follows the recommendations in this kb (the Option 2) to import it successfully. See those explicit mentions in the code:

EntraCP/Yvand.EntraCP/Yvand.EntraClaimsProvider/Configuration/EntraIDTenant.cs

Line 355 in ddb76a0

// If passwordless, import the private key as documented in https://support.microsoft.com/en-us/topic/kb5025823-change-in-how-net-applications-import-x-509-certificates-bf81c936-af2b-446e-9f7a-016f4713b46b

EntraCP/Yvand.EntraCP/Yvand.EntraClaimsProvider/Configuration/EntraIDTenant.cs

Line 379 in ddb76a0

// If passwordless, import the private key as documented in https://support.microsoft.com/en-us/topic/kb5025823-change-in-how-net-applications-import-x-509-certificates-bf81c936-af2b-446e-9f7a-016f4713b46b

Besides, EntraCP uses only the EphemeralKeySet to load the certificate, which is great to avoid any sort of permission issues, and appropriate since the certificate is stored in the config database.
So it should really not matter from which server you register the client certificate.

Also, property ClientCertificateWithPrivateKeyreally is read-only so the error you reported is actually not an error, it is legit.
The proper way to register a client certificate is by calling SetCredentials() method